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Title: UNSUB(S); 

UNITED STATES AIR FORCE 
INSTITUTE OF TECHNOLOGY - VICTIM; 

CITA - COMPUTER INTRUSION; 

00: CINCINNATI 

Synopsis: This communication is to forward documents to the 

original case file. Referral/consult 

Brinioffnrefsl : T wo copies of Request For Information letters sent 
to| | One copy of response from NAVCIRT regarding 

possible material related to captioned matter. 

Details: Enclosed for Cincinnati are copies of documents 

generated by or directed to the National Infrastructure 
Protection Center (NIPC) regarding captioned matter. These 
documents are being forwarded to Cincinnati for inclusion in the 
original case file. 
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ALL INFORMATION CONTAINED 
HEREIN 15 UNCLASSIFIED 


3ATE 07-06-2012 BY 60324/UC /h aw/sab/aio 


U.S. Department of Justice 


Federal Bureau of Investigation 


Washington, D. C. 20535-0001 

August 4,1998 


Deal 


Referral/Consult 


This letter is to request information fforr J databases and published reports that 
may be relevant to an ongoing FBI criminal investigation. The investigation centers on a series 
of intrusions into computer systems located at Wright Patterson Air Force Base. The intrusions 
appear to originate from a series of Internet service providers located in the Russian Federation. 

It also appears that the intruder is connecting to the ISPs through a "dial-up" connection, which 
suggests a local (i.e. Russian) point of origin. The FBI currently possesses no information 
indicating that the attacker is a U.S. person. 

Technical information relevant to this request is provided in the enclosure, which 
also specifies an operational point of contact in the FBI. As additional techn ical in formation 
becomes available, it will be forwarded to the operational point of contact at 


The FBI l egal contact point for this matter is Assistant General Counsel[ 


Thank you tor your assistance in this matter. 


1 Please do not hesitate to call him if you require additional information. 


] 


Sincerely, 


Associate General Counsel for National 
Security Affairs 
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The Wright Patterson Air Force Base (WPAFB), a key educational and research and 
development base, has documented numerous intrusions into approximately eight of their 
systems. The attacks primarily come through computers located in the computer lab at the 
University of Cincinnati. However, attacks have been seen from Wright University, located in 
Dayton, OH and Aticoip.net located in Charleston, SC. The intrusions into these U.S. systems 
appears to be originating from a dialup connection to four Internet Service Providers (ISPs) 
located in Russia. The hacking occurs Monday through Friday, midnight and approximately 
9:00 a.m. EDT. 


The following are thq 


involved: 


b7E 


The following passwords or environment variables have been used during the intrusions: 


The following are usernames, software authors or tool names: 


b6 
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is the name ofl 


student whose account is being used at 


Our information indicates she is a non-U.S. 


person.) 


The following files are known to have been taken by the hacker from WPAFB: 


b7E 


NIPC Operational POC is SSA 
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U.S. Department of Justice 


Federal Bureau of Investigation 


Washington, D. C. 20535-0001 

August 3,1998 


Referral/Consult 


DeaJ 


This letter is to request information fron£ 


patabases and published reports 
The investigation centers on a 


. that may be relevant to an ongoing FBI criminal investigation. _ 

series of intrusions into computer systems located at Wright Patterson Air Force Base. The 
intrusions appear to originate from a series of Internet service providers located in the Russian 
Federation. It also appears that the intruder is connecting to the ISPs through a "dial-up" 
connection, which suggests a local (i.e. Russian) point of origin. The FBI currently possesses no 
inf ormation indicating that the attacker is a U.S. person. 


Technical information relevant to this request is provided in the enclosure, which 
also specifies an operational point of contact in the FBI. As additional tec hnical info rmation 
becomes available, it will be forwarded to the operational point of contact a|_| 

_ Thf». FRT legal contact point for this matter is Assistant General Counsel I--— 

| Please do not hesitate to call him if you require additional information. 
Thank you for your assistance in this matter. 


Sincerely, 


Associate (ieneral uounsei ror National 
Security Affairs 
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U.S. Department of Justice 
Federal Bureau of Investigation 



Washington, D. C. 20535-0001 


August 31,1998 



FBI criminal investigation. The investigation centers on a series of intrusions into computer 
systems located at Wright Patterson Air Force Base. The intrusions appear to originate from a 
(D) series of Internet service providers located in the Russian Federation. It also appears that the 
intruder is connecting to the ISPs through a "dial-up" connection, which suggests a local (i.e. 

Russian) point of origin. The FBI currently possesses no information indicating that the attacker 
is a U.S. person. 

The FBT ha s already made (in an August 21,1998, letter addressed to Acting 

General Counse l I a standard Request for In formation in connection with this_ 

(U) investigation. The purpose of this letter is to add a technical assistance request so tha j ~| 

expert personnel can assist the FBI investigators on certain technical questions relating to b< 

computer data collected by the FBI. b ' 

_ The FBI legal contact point for this matter is Assistant General Counsel l 

' | Please do not hesitate to call him if you require additional information, 

i nanK you tor your assistance in this matter. (U) 

Sincerely, _ 

b6 

b7C 

Associate General Counsel for National 
Security Affairs 







